Data Protection Law In Qatar

At the end of 2016, the legislative framework for data protection in Qatar was overhauled by Law No. 13 of 2016 Concerning Personal Data Protection (the DPL). Over a year on, we take a look at the DPL and how it is likely to transform the regulatory landscape for privacy in Qatar.

The DPL incorporates concepts familiar from other international privacy frameworks and enshrines an individual's right to have their personal data protected. It mandates that any party who processes such data adhere to the principles of transparency, fairness and respect for human dignity. It will require prompt action to ensure compliance, both for governance reasons and given that the law introduces material fines for breach.

The DPL will help build consumer trust in Qatar in the online environment and may encourage consumers to engage with innovative technologies in confidence that their data will be protected. It comes at a time when the rapid pace of technological change means that more personal data than ever before is being processed electronically, including the advance of big data and internet of things technologies.

Scope of application of the DPL

The DPL applies to: (i) personal data, being data relating to identifiable individuals; and (ii) any personal data that is processed electronically.

The DPL will apply in most instances where personal data is handled. Article 2 provides that the requirements shall apply where personal data (being data which identifies an individual or which can be used in combination with other data to identify an individual) is electronically processed, or obtained, gathered or extracted in preparation for electronic processing, or where a combination of electronic and traditional processing is used.

The regulator responsible for implementing and enforcing the DPL in Qatar is the Ministry of Transport and Communications (MoTC). The DPL does not specify any geographic limitations on its application. However, the MoTC's ability to bring enforcement action against organisations with no legal presence in Qatar will be limited.

Companies operating in Qatar have been given a grace period, until 30 June 2018, to achieve compliance with the DPL.

Failure to comply with requirements of the DPL may give rise to a fine of up to a maximum of five million Qatari Riyals (equivalent to approximately 1,375,000 US Dollars). Specific penalties apply to breach of the different fundamental articles of the DPL.

Requirements of the DPL

Where the DPL...